Note in docs on sqli, fixes #215